Cdpo Ransomware Encrypts Most File Types

Through our analysis of malware samples, we have determined that Cdpo is a ransomware variant associated with the Djvu family. Cdpo encrypts files and appends its extension (".cdpo") to the filenames. For instance, it changes "1.jpg" to "1.jpg.cdpo," "2.png" to "2.png.cdpo," and so forth.

Additionally, Cdpo generates a ransom note in the form of a text file named "_readme.txt," containing payment instructions and contact details. It's important to highlight that Djvu ransomware attacks often involve the presence of information stealers like Vidar or RedLine. The ransom message asserts that various files, including images, databases, and documents, have undergone encryption using a robust algorithm. Retrieval is stated to be possible only through obtaining a specialized decrypt tool along with a unique key. The perpetrators demand a payment of $1999 for these tools, offering a 50% discount as an incentive if the victim initiates contact within a 72-hour period.

Furthermore, the threat actors suggest showcasing their decryption capabilities by providing a complimentary decryption of a single file. However, the condition is that the supplied file should not contain valuable information. The contact details provided are two email addresses: support@freshingmail.top and datarestorehelpyou@airmail.cc.

Table of Contents

Cdpo Ransom Note Mimics Djvu Layout

The full text of the Cdpo ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-FCWSCsjEWS
Price of private key and decrypt software is $1999.
Discount 50% available if you contact us first 72 hours, that's price for you is $999.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshingmail.top

Reserve e-mail address to contact us:
datarestorehelpyou@airmail.cc

Your personal ID:

What Are the Best Preventive Measures to Protect Your Data from Ransomware?

Protecting your data from ransomware involves a combination of technical measures, user awareness, and proactive practices. Here are some best preventive measures to safeguard your data from ransomware attacks:

Regular Backups:
Perform regular backups of your important data and ensure they are stored offline or in a secure, isolated environment.
Automate backup processes to minimize the risk of human error.

Update Software Regularly:
Keep your operating system, antivirus software, and all applications up-to-date with the latest security patches.
Enable automatic updates whenever possible.

Use Reliable Security Software:
Install reputable antivirus and anti-malware software to detect and prevent ransomware infections.
Ensure that the security software is regularly updated.

Educate and Train Users:
Conduct regular cybersecurity awareness training for employees to recognize phishing emails, malicious links, and suspicious attachments.
Promote a security-conscious culture within the organization.

Exercise Caution with Email:
Be wary of unsolicited emails, especially those with unexpected attachments or links. Verify the sender's identity before clicking on any links or downloading attachments.